@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/lib/auth/status-list.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * OAuth Token Status List (draft-ietf-oauth-status-list-20).
+ *
+ * An issuer publishes a JWT-wrapped bitstring at a URL; relying
+ * parties fetch + check the bit at index N to determine if the
+ * credential whose `status_list` claim points at that URL + index
+ * has been revoked / suspended / is still valid. The format is the
+ * canonical replacement for the older "status list" mechanisms in
+ * SD-JWT VC and OpenID for Verifiable Credentials.
+ *
+ * Status values per draft §4.2:
+ *   0 = VALID
+ *   1 = INVALID
+ *   2 = SUSPENDED
+ *   3 = APPLICATION_SPECIFIC
+ *   ... (1-bit / 2-bit / 4-bit / 8-bit `bits` size — operator picks)
+ *
+ *   var list = b.auth.statusList.create({ size: 1024, bits: 1 });
+ *   list.set(42, 1);                                  // mark idx 42 INVALID
+ *   var jwt = await list.toJwt({
+ *     issuer:     "https://issuer.example.com",
+ *     subject:    "https://issuer.example.com/status/list/1",
+ *     privateKey: env("STATUS_LIST_PRIVATE_KEY_PEM"),
+ *     algorithm:  "ML-DSA-87",      // matches b.auth.jwt's PQC default
+ *   });
+ *
+ *   // Receive side:
+ *   var rv = await b.auth.statusList.fromJwt(jwt, { publicKey: pem });
+ *   rv.list.get(42)   // → 1 (INVALID)
+ *
+ * The JWT payload shape per draft §6.1:
+ *   {
+ *     iss: "<issuer>",
+ *     sub: "<this-list-uri>",
+ *     iat: <issued-at>,
+ *     exp: <optional-expires>,
+ *     ttl: <optional-cache-ttl>,
+ *     status_list: { bits: 1|2|4|8, lst: "<base64url(zlib(bitstring))>" },
+ *   }
+ *
+ * The bitstring is zlib-deflated (RFC 1951 raw deflate per draft
+ * §6.1.4) before base64url encoding so a million-entry list collapses
+ * to a few KB on the wire when most bits are zero.
+ */
+
+var nodeCrypto = require("node:crypto");
+var zlib = require("node:zlib");
+var bCrypto = require("../crypto");
+var safeJson = require("../safe-json");
+var validateOpts = require("../validate-opts");
+var C = require("../constants");
+var jwt = require("./jwt");
+var { defineClass } = require("../framework-error");
+
+var StatusListError = defineClass("StatusListError", { alwaysPermanent: true });
+
+var SUPPORTED_BIT_SIZES = { 1: 1, 2: 1, 4: 1, 8: 1 };                            // allow:raw-byte-literal — bit-size enum (1/2/4/8 bits per status), not bytes
+var STATUS_VALID                = 0;
+var STATUS_INVALID              = 1;
+var STATUS_SUSPENDED            = 2;
+var STATUS_APPLICATION_SPECIFIC = 3;
+
+// Cap the on-the-wire compressed payload at 1 MiB (a million 1-bit
+// entries compress to ~125 KB when most are zero; 8 MiB on the wire
+// is more than the spec's expected use). Operators publishing larger
+// status lists should shard.
+var MAX_LIST_BYTES = C.BYTES.mib(1);
+
+function _b64url(buf) { return bCrypto.toBase64Url(buf); }
+
+function _fromB64url(s) {
+  try { return bCrypto.fromBase64Url(s); }
+  catch (_e) {
+    throw new StatusListError("status-list/bad-base64",
+      "status-list segment is not valid base64url");
+  }
+}
+
+function _validateBits(bits) {
+  if (!SUPPORTED_BIT_SIZES[bits]) {
+    throw new StatusListError("status-list/bad-bits",
+      "statusList: bits must be 1, 2, 4, or 8 (draft §6.1.1) — got " + bits);
+  }
+}
+
+function _validateStatus(status, bits) {
+  if (typeof status !== "number" || !isFinite(status) || status < 0 || (status >> 0) !== status) {
+    throw new StatusListError("status-list/bad-status",
+      "statusList: status must be a non-negative integer — got " + status);
+  }
+  var max = (1 << bits) - 1;
+  if (status > max) {
+    throw new StatusListError("status-list/bad-status",
+      "statusList: status " + status + " exceeds bits=" + bits + " ceiling " + max);
+  }
+}
+
+function create(opts) {
+  validateOpts.requireObject(opts, "statusList.create", StatusListError);
+  validateOpts(opts, ["size", "bits", "fill"], "statusList.create");
+  var size = opts.size;
+  if (typeof size !== "number" || !isFinite(size) || size <= 0 || (size >> 0) !== size) {
+    throw new StatusListError("status-list/bad-size",
+      "statusList.create: size must be a positive integer — got " + size);
+  }
+  var bits = opts.bits === undefined ? 1 : opts.bits;
+  _validateBits(bits);
+  // Allocate the bit-packed buffer up front. byteCount = ceil(size*bits/8).
+  var bitBytes = Math.ceil((size * bits) / 8);                                   // allow:raw-byte-literal — bits-per-byte conversion
+  var bytes = Buffer.alloc(bitBytes);
+  if (opts.fill !== undefined && opts.fill !== 0) {
+    _validateStatus(opts.fill, bits);
+    for (var i = 0; i < size; i += 1) _setAt(bytes, bits, i, opts.fill);
+  }
+
+  function set(idx, status) {
+    if (typeof idx !== "number" || idx < 0 || idx >= size || (idx >> 0) !== idx) {
+      throw new StatusListError("status-list/bad-index",
+        "statusList.set: idx out of range — got " + idx + ", size=" + size);
+    }
+    _validateStatus(status, bits);
+    _setAt(bytes, bits, idx, status);
+  }
+
+  function get(idx) {
+    if (typeof idx !== "number" || idx < 0 || idx >= size || (idx >> 0) !== idx) {
+      throw new StatusListError("status-list/bad-index",
+        "statusList.get: idx out of range — got " + idx + ", size=" + size);
+    }
+    return _getAt(bytes, bits, idx);
+  }
+
+  function snapshot() {
+    return { size: size, bits: bits, bytes: Buffer.from(bytes) };
+  }
+
+  // ---- JWT issuance ----
+  // Returns the canonical JWT payload + signed compact form per
+  // draft §6.1. The signing key is operator-supplied; the framework
+  // wraps b.auth.jwt.sign with the status-list-specific claim shape.
+  async function toJwt(jwtOpts) {
+    validateOpts.requireObject(jwtOpts, "statusList.toJwt", StatusListError);
+    validateOpts(jwtOpts, [
+      "issuer", "subject", "privateKey", "algorithm",
+      "expiresInSec", "notBeforeSec", "now", "ttl",
+    ], "statusList.toJwt");
+    validateOpts.requireNonEmptyString(jwtOpts.issuer,
+      "statusList.toJwt: issuer", StatusListError, "status-list/bad-issuer");
+    validateOpts.requireNonEmptyString(jwtOpts.subject,
+      "statusList.toJwt: subject", StatusListError, "status-list/bad-subject");
+    var deflated = zlib.deflateRawSync(bytes);
+    if (deflated.length > MAX_LIST_BYTES) {
+      throw new StatusListError("status-list/too-large",
+        "statusList.toJwt: compressed list exceeds " + MAX_LIST_BYTES + " bytes — shard the list");
+    }
+    var lst = _b64url(deflated);
+    var claims = {
+      iss:         jwtOpts.issuer,
+      sub:         jwtOpts.subject,
+      status_list: { bits: bits, lst: lst },
+    };
+    if (typeof jwtOpts.ttl === "number") claims.ttl = jwtOpts.ttl;
+    return await jwt.sign(claims, {
+      privateKey:   jwtOpts.privateKey,
+      algorithm:    jwtOpts.algorithm,
+      typ:          "statuslist+jwt",
+      expiresInSec: jwtOpts.expiresInSec,
+      notBeforeSec: jwtOpts.notBeforeSec,
+      now:          jwtOpts.now,
+    });
+  }
+
+  return {
+    set:        set,
+    get:        get,
+    size:       size,
+    bits:       bits,
+    snapshot:   snapshot,
+    toJwt:      toJwt,
+  };
+}
+
+// ---- bit-packed helpers ----
+
+function _setAt(bytes, bits, idx, status) {
+  if (bits === 8) { bytes[idx] = status & 0xff; return; }                        // allow:raw-byte-literal — byte mask
+  var bitOffset = idx * bits;
+  var byteIdx   = Math.floor(bitOffset / 8);                                     // allow:raw-byte-literal — bits-per-byte
+  var bitInByte = bitOffset % 8;                                                 // allow:raw-byte-literal — bits-per-byte
+  var mask      = ((1 << bits) - 1) << bitInByte;
+  bytes[byteIdx] = (bytes[byteIdx] & ~mask) | ((status << bitInByte) & mask);
+}
+
+function _getAt(bytes, bits, idx) {
+  if (bits === 8) return bytes[idx];                                             // allow:raw-byte-literal — 8-bit fast path
+  var bitOffset = idx * bits;
+  var byteIdx   = Math.floor(bitOffset / 8);                                     // allow:raw-byte-literal — bits-per-byte
+  var bitInByte = bitOffset % 8;                                                 // allow:raw-byte-literal — bits-per-byte
+  var mask      = (1 << bits) - 1;
+  return (bytes[byteIdx] >> bitInByte) & mask;
+}
+
+// ---- JWT verification ----
+
+async function fromJwt(token, opts) {
+  validateOpts.requireObject(opts, "statusList.fromJwt", StatusListError);
+  if (typeof token !== "string" || token.length === 0) {
+    throw new StatusListError("status-list/bad-token",
+      "statusList.fromJwt: token must be a non-empty string");
+  }
+  // Verify the JWT signature using the framework's b.auth.jwt verifier.
+  // Allow operator-supplied algorithms (defaults to PQC list).
+  var claims = await jwt.verify(token, {
+    publicKey:    opts.publicKey,
+    keyResolver:  opts.keyResolver,
+    algorithms:   opts.algorithms,
+    issuer:       opts.expectedIssuer,
+    audience:     opts.expectedAudience,
+    clockToleranceSec: opts.clockToleranceSec,
+    now:          opts.now,
+  });
+  var sl = claims.status_list;
+  if (!sl || typeof sl !== "object" || typeof sl.lst !== "string") {
+    throw new StatusListError("status-list/bad-claims",
+      "statusList.fromJwt: payload missing status_list.lst (draft §6.1)");
+  }
+  var bits = sl.bits === undefined ? 1 : sl.bits;
+  _validateBits(bits);
+  var deflated;
+  try { deflated = _fromB64url(sl.lst); }
+  catch (e) {
+    throw new StatusListError("status-list/bad-base64",
+      "statusList.fromJwt: lst is not valid base64url: " + ((e && e.message) || String(e)));
+  }
+  if (deflated.length > MAX_LIST_BYTES) {
+    throw new StatusListError("status-list/too-large",
+      "statusList.fromJwt: compressed list exceeds " + MAX_LIST_BYTES + " bytes");
+  }
+  var inflated;
+  try { inflated = zlib.inflateRawSync(deflated, { maxOutputLength: MAX_LIST_BYTES * 8 }); }      // allow:raw-byte-literal — 8x compression-ratio cap
+  catch (e) {
+    throw new StatusListError("status-list/inflate-failed",
+      "statusList.fromJwt: zlib inflate failed: " + ((e && e.message) || String(e)));
+  }
+  // Reconstruct the list object pointing at the inflated bytes.
+  var size = (inflated.length * 8) / bits;                                       // allow:raw-byte-literal — bits-per-byte
+  return {
+    list: {
+      size:     size,
+      bits:     bits,
+      get:      function (idx) { return _getAt(inflated, bits, idx); },
+      snapshot: function () { return { size: size, bits: bits, bytes: Buffer.from(inflated) }; },
+    },
+    claims: claims,
+  };
+}
+
+// Provide structured-error helpers so a tree-shake-friendly consumer
+// can write switch(status) { case b.auth.statusList.STATUS_VALID: ... }.
+void safeJson;                                                                   // imported for symmetry; reserved for future helpers
+void nodeCrypto;
+
+module.exports = {
+  create:      create,
+  fromJwt:     fromJwt,
+  STATUS_VALID:                 STATUS_VALID,
+  STATUS_INVALID:               STATUS_INVALID,
+  STATUS_SUSPENDED:             STATUS_SUSPENDED,
+  STATUS_APPLICATION_SPECIFIC:  STATUS_APPLICATION_SPECIFIC,
+  StatusListError:              StatusListError,
+};

package/lib/vendor/blamejs/lib/auth/step-up-policy.js

@@ -0,0 +1,335 @@
+"use strict";
+/**
+ * Step-up policy DSL — compose RFC 9470 step-up requirements as a
+ * fluent expression rather than a flat object. Useful for routes that
+ * need "ACR >= loa3 OR a fresh hardware-key auth within the last 5 min".
+ *
+ *   var policy = b.auth.stepUp.policy
+ *                 .acr("loa3")
+ *                 .and(b.auth.stepUp.policy.maxAge(300))
+ *                 .or(
+ *                   b.auth.stepUp.policy.amr(["hwk", "pop"])
+ *                     .and(b.auth.stepUp.policy.maxAge(120))
+ *                 );
+ *
+ *   var result = policy.evaluate(claims);
+ *
+ *   var middleware = policy.middleware({ realm: "billing-api" });
+ *
+ * The policy compiles down to RFC 9470 challenges by extracting the
+ * outermost-feasible (acr, maxAge, amr, ...) tuple. When an operator's
+ * policy is genuinely or-of-and-of-..., the challenge emitted is the
+ * UNION of individually-required atoms (so the IdP knows what to ask
+ * for) plus an `error_description` hint that there are alternatives.
+ *
+ * The DSL is pure. All node types are immutable once constructed;
+ * chaining returns a new policy object.
+ */
+
+var lazyRequire   = require("../lazy-require");
+var validateOpts  = require("../validate-opts");
+var { AuthError } = require("../framework-error");
+
+var stepUp        = lazyRequire(function () { return require("./step-up"); });
+var requireStepUp = lazyRequire(function () { return require("../middleware/require-step-up"); });
+
+function _mkNode(spec) {
+  spec.evaluate = function (claims) {
+    return spec._run(claims);
+  };
+  spec.toRequirement = function () {
+    return spec._toReq();
+  };
+  spec.and = function (other) {
+    return _and(spec, other);
+  };
+  spec.or = function (other) {
+    return _or(spec, other);
+  };
+  spec.not = function () {
+    return _not(spec);
+  };
+  spec.middleware = function (opts) {
+    opts = opts || {};
+    return requireStepUp().create(Object.assign({}, opts, {
+      requirement: spec._toReq(),
+    }));
+  };
+  return Object.freeze(spec);
+}
+
+function acr(value) {
+  validateOpts.requireNonEmptyString(value, "policy.acr: value", AuthError, "auth-stepUp/bad-acr");
+  return _mkNode({
+    kind:  "acr",
+    value: value,
+    _run: function (claims) {
+      var result = stepUp().evaluate({
+        claims:      claims,
+        requirement: { acr: value },
+      });
+      return { ok: result.ok === true, atom: "acr:" + value, reason: result.reason || null };
+    },
+    _toReq: function () { return { acr: value }; },
+  });
+}
+
+function acrAny(values) {
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new AuthError("auth-stepUp/bad-policy",
+      "policy.acrAny: values must be a non-empty array");
+  }
+  for (var i = 0; i < values.length; i += 1) {
+    validateOpts.requireNonEmptyString(values[i],
+      "policy.acrAny: values[" + i + "]", AuthError, "auth-stepUp/bad-acr");
+  }
+  var copy = values.slice();
+  return _mkNode({
+    kind:   "acrAny",
+    values: copy,
+    _run:  function (claims) {
+      var result = stepUp().evaluate({
+        claims:      claims,
+        requirement: { acrValues: copy },
+      });
+      return { ok: result.ok === true, atom: "acrAny:" + copy.join(","), reason: result.reason || null };
+    },
+    _toReq: function () { return { acrValues: copy }; },
+  });
+}
+
+function amr(required) {
+  if (!Array.isArray(required) || required.length === 0) {
+    throw new AuthError("auth-stepUp/bad-policy",
+      "policy.amr: required must be a non-empty array");
+  }
+  for (var i = 0; i < required.length; i += 1) {
+    validateOpts.requireNonEmptyString(required[i],
+      "policy.amr: required[" + i + "]", AuthError, "auth-stepUp/bad-amr");
+  }
+  var copy = required.slice();
+  return _mkNode({
+    kind:     "amr",
+    required: copy,
+    _run:    function (claims) {
+      var result = stepUp().evaluate({
+        claims:      claims,
+        requirement: { requiredAmr: copy },
+      });
+      return { ok: result.ok === true, atom: "amr:" + copy.join("+"), reason: result.reason || null };
+    },
+    _toReq: function () { return { requiredAmr: copy }; },
+  });
+}
+
+function phishingResistant() {
+  return _mkNode({
+    kind:  "phishingResistant",
+    _run: function (claims) {
+      var result = stepUp().evaluate({
+        claims:      claims,
+        requirement: { phishingResistant: true },
+      });
+      return { ok: result.ok === true, atom: "phr", reason: result.reason || null };
+    },
+    _toReq: function () { return { phishingResistant: true }; },
+  });
+}
+
+function maxAge(seconds) {
+  if (typeof seconds !== "number" || !isFinite(seconds) || seconds < 0) {
+    throw new AuthError("auth-stepUp/bad-policy",
+      "policy.maxAge: seconds must be a finite number >= 0 — got " +
+      JSON.stringify(seconds));
+  }
+  return _mkNode({
+    kind:    "maxAge",
+    seconds: seconds,
+    _run:   function (claims) {
+      var result = stepUp().evaluate({
+        claims:      claims,
+        requirement: { maxAge: seconds },
+      });
+      return { ok: result.ok === true, atom: "maxAge:" + seconds, reason: result.reason || null };
+    },
+    _toReq: function () { return { maxAge: seconds }; },
+  });
+}
+
+function custom(name, fn) {
+  validateOpts.requireNonEmptyString(name, "policy.custom: name", AuthError, "auth-stepUp/bad-policy");
+  if (typeof fn !== "function") {
+    throw new AuthError("auth-stepUp/bad-policy",
+      "policy.custom: fn must be a function — got " + typeof fn);
+  }
+  return _mkNode({
+    kind: "custom",
+    name: name,
+    _run: function (claims) {
+      var ok = false;
+      try { ok = fn(claims) === true; } catch (_e) { ok = false; }
+      return { ok: ok, atom: "custom:" + name, reason: ok ? null : "custom predicate '" + name + "' returned false" };
+    },
+    _toReq: function () {
+      throw new AuthError("auth-stepUp/policy-no-challenge",
+        "policy.custom: cannot translate to RFC 9470 challenge — wrap in .or() with a translatable atom or use .middleware({ requirement: ... })");
+    },
+  });
+}
+
+function _and(left, right) {
+  return _mkNode({
+    kind:  "and",
+    left:  left,
+    right: right,
+    _run: function (claims) {
+      var l = left._run(claims);
+      if (!l.ok) return { ok: false, atom: "and(" + l.atom + ")", reason: l.reason };
+      var r = right._run(claims);
+      if (!r.ok) return { ok: false, atom: "and(" + l.atom + "," + r.atom + ")", reason: r.reason };
+      return { ok: true, atom: "and(" + l.atom + "," + r.atom + ")", reason: null };
+    },
+    _toReq: function () {
+      var lr = left._toReq();
+      var rr = right._toReq();
+      return _mergeAnd(lr, rr);
+    },
+  });
+}
+
+function _or(left, right) {
+  return _mkNode({
+    kind:  "or",
+    left:  left,
+    right: right,
+    _run: function (claims) {
+      var l = left._run(claims);
+      if (l.ok) return { ok: true, atom: "or(" + l.atom + ")", reason: null };
+      var r = right._run(claims);
+      if (r.ok) return { ok: true, atom: "or(" + r.atom + ")", reason: null };
+      return {
+        ok: false,
+        atom: "or(" + l.atom + "," + r.atom + ")",
+        reason: l.reason + " AND " + r.reason,
+      };
+    },
+    _toReq: function () {
+      // RFC 9470 doesn't support OR semantics in WWW-Authenticate. We
+      // pick the LEFT branch and emit its challenge — operator can
+      // override via .middleware({ requirement }).
+      return left._toReq();
+    },
+  });
+}
+
+function _not(inner) {
+  return _mkNode({
+    kind:  "not",
+    inner: inner,
+    _run: function (claims) {
+      var i = inner._run(claims);
+      return { ok: !i.ok, atom: "not(" + i.atom + ")", reason: i.ok ? "not(" + i.atom + ") matched" : null };
+    },
+    _toReq: function () {
+      throw new AuthError("auth-stepUp/policy-no-challenge",
+        "policy.not: cannot translate to RFC 9470 challenge");
+    },
+  });
+}
+
+function _mergeAnd(a, b) {
+  var out = {};
+  if (a.acr || b.acr) {
+    if (a.acr && b.acr && a.acr !== b.acr) {
+      throw new AuthError("auth-stepUp/policy-conflict",
+        "policy.and: conflicting acr requirements " +
+        JSON.stringify(a.acr) + " and " + JSON.stringify(b.acr));
+    }
+    out.acr = a.acr || b.acr;
+  }
+  if (a.acrValues || b.acrValues) {
+    out.acrValues = (a.acrValues || []).concat(b.acrValues || []);
+  }
+  if (a.maxAge != null && b.maxAge != null) {
+    out.maxAge = Math.min(a.maxAge, b.maxAge);                 // tighter wins
+  } else if (a.maxAge != null) {
+    out.maxAge = a.maxAge;
+  } else if (b.maxAge != null) {
+    out.maxAge = b.maxAge;
+  }
+  if (a.requiredAmr || b.requiredAmr) {
+    var combined = (a.requiredAmr || []).concat(b.requiredAmr || []);
+    var seen = Object.create(null);
+    out.requiredAmr = [];
+    for (var i = 0; i < combined.length; i += 1) {
+      if (!seen[combined[i]]) {
+        seen[combined[i]] = true;
+        out.requiredAmr.push(combined[i]);
+      }
+    }
+  }
+  if (a.phishingResistant === true || b.phishingResistant === true) {
+    out.phishingResistant = true;
+  }
+  return out;
+}
+
+// ---- Common preset policies operators reach for ----
+
+var C = require("../constants");
+var SEC_5_MIN  = C.TIME.minutes(5)  / C.TIME.seconds(1);
+var SEC_2_MIN  = C.TIME.minutes(2)  / C.TIME.seconds(1);
+var SEC_15_MIN = C.TIME.minutes(15) / C.TIME.seconds(1);
+var SEC_1_MIN  = C.TIME.minutes(1)  / C.TIME.seconds(1);
+
+var PRESETS = {
+  // Sensitive write: ACR >= loa2 + auth_time within 5 min
+  sensitiveWrite: function () {
+    return acr("loa2").and(maxAge(SEC_5_MIN));
+  },
+  // Admin bulk: ACR >= loa3 + max_age 5 min + phishing-resistant
+  adminBulk: function () {
+    return acr("loa3").and(maxAge(SEC_5_MIN)).and(phishingResistant());
+  },
+  // Financial: phr-class hardware + max_age 2 min
+  financial: function () {
+    return acr("loa3").and(amr(["hwk"])).and(maxAge(SEC_2_MIN));
+  },
+  // PHI read: ACR >= loa2 + max_age 15 min
+  phiRead: function () {
+    return acr("loa2").and(maxAge(SEC_15_MIN));
+  },
+  // PHI write: ACR >= loa3 + max_age 5 min + phishing-resistant
+  phiWrite: function () {
+    return acr("loa3").and(maxAge(SEC_5_MIN)).and(phishingResistant());
+  },
+  // Account-recovery: phishing-resistant + max_age 1 min
+  accountRecovery: function () {
+    return phishingResistant().and(maxAge(SEC_1_MIN));
+  },
+};
+
+function preset(name) {
+  if (!Object.prototype.hasOwnProperty.call(PRESETS, name)) {
+    throw new AuthError("auth-stepUp/bad-preset",
+      "policy.preset: unknown preset " + JSON.stringify(name) +
+      " — valid presets: " + Object.keys(PRESETS).join(", "));
+  }
+  return PRESETS[name]();
+}
+
+function listPresets() {
+  return Object.keys(PRESETS).slice();
+}
+
+module.exports = {
+  acr:                acr,
+  acrAny:             acrAny,
+  amr:                amr,
+  phishingResistant:  phishingResistant,
+  maxAge:             maxAge,
+  custom:             custom,
+  preset:             preset,
+  listPresets:        listPresets,
+  PRESETS:            PRESETS,
+};